4,779 reputation
1734
bio website
location Netherlands
age 40
visits member for 2 years, 10 months
seen 51 mins ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Sep
1
comment CBC-MAC based on PRF
Did a bit of research, but this algorithm goes back to FIPS 113 (1985), and that "standard" does not do too much reasoning. OMAC and CMAC papers don't list the reason either. So the best answer may be that it uses a PRP because if it was a PRF, it would be a HMAC :P
Sep
1
comment CBC-MAC based on PRF
Why not? Most of the time a PRP is faster, and it is nice if you can use the same primitive for both confidentiality and integrity/authenticity (e.g. CCM & EAX mode of encryption).
Sep
1
comment Are partial hashes used in cryptographic protocols?
@tylo Well, for security tokens/smart cards there is PIN or biometric authentication. That's some kind of "user consent". I agree that there is still plenty that can be done by a malicious terminal though; that's actually one of my peeves against this kind of security - at some point in time you need to trust the terminal anyway. I mean, if a covert channel is possible, then it is also possible to sign any other content, which is much worse.
Sep
1
comment Are partial hashes used in cryptographic protocols?
@tylo Agreed. And it would be rather easy to couple data or meaning to a hash as well. I think you need to be able to trust the data you are signing. The question is then if the partial hash is adding security or not. Of course, a covert channel in signed data is of more importance than a covert channel elsewhere (as there is user consent to create the signature, possibly at a specific time/place).
Aug
31
revised Are partial hashes used in cryptographic protocols?
made the question as little opinion based as possible
Aug
31
asked Are partial hashes used in cryptographic protocols?
Aug
30
comment How should I treat a new cipher release like Spritz?
Added some Spritz related information; interesting cipher indeed. Drop in replacement for RC4 and it resembles a sponge.
Aug
30
revised How should I treat a new cipher release like Spritz?
added 141 characters in body
Aug
30
reviewed Close Good challenges for a crypto competition for teenagers
Aug
30
reviewed Close Security of very simple XOR with random?
Aug
30
reviewed Close Seemingly simple decryption question
Aug
30
reviewed Close What's the best packet cipher mode for use with UDP for example? Advantages or disadvantages of any alternatives?
Aug
30
reviewed Looks OK What is the most secure hand cipher?
Aug
30
comment practically verifying block ciphers strength
I've voted to close as it is now impossible to tell what is asked by now. Asking for tool references seems to be off topic as well.
Aug
29
comment Why do new versions of TLS use an explicit IV for CBC suites?
@imichaelmiers Looking back at this old comment; I guess using a secure random value as IV introduces more overhead than calculating one using symmetric primitives on most systems (i.e. where no hardware support is present).
Aug
29
answered Are there other digital certificate formats than X.509?
Aug
29
comment Are there other digital certificate formats than X.509?
Or more concisely, I think it says that X509 certificates are generic certificates that are not tied to a particular use. I think the last sentences are a bit misleading. If I buy a digital certificate for a server, it does not make sense to use it to sign word documents as well. You can certainly make clear in how a certificate should be used within the certificate itself. The format is generic, the certificate itself may be particular to a use case.
Aug
29
answered How should I treat a new cipher release like Spritz?
Aug
28
comment Choice of authenticated encryption mode for whole messages
greed, 1 $1/2$ pass seems reasonable. I'm on CET as well, e-sushi. Germany and the Netherlands are quite close by :) Goodnight!
Aug
28
comment Choice of authenticated encryption mode for whole messages
GCM is a two pass scheme as well. Maybe it doesn't use a block cipher for the second pass, but that does not make it a single pass scheme in my mind (nor to the EAX authors, apparently "More recent still is GCM [22], a parallelizable, two-pass design based on multiplication in the finite field with 2128 elements.")